Apex domain resolves to phantom AWS IPs not present in my Netlify DNS zone — blocks SSL provisioning

Support
,
1

My site is comforting-hummingbird-13904d.netlify.app, custom domain kove-ai.com (registered at GoDaddy, using Netlify DNS / NS1 nameservers).

The apex kove-ai.com resolves to two AWS IPs — 98.84.224.111 and 18.208.88.157 (TTL 2 min) — confirmed via whatsmydns.net and Google’s resolver. These IPs do not exist anywhere in my Netlify DNS zone.

My DNS zone currently contains only correct records:

  • kove-ai.com — NETLIFY → comforting-hummingbird-13904d.netlify.app
  • www.kove-ai.com — CNAME → kove-ai.com
  • MX, SPF, DKIM, and Google verification records
  • (No A records, and no AWS IPs anywhere)

Nameservers are confirmed as Netlify’s (nsone.net) via whatsmydns NS lookup. The site loads via www, but https://kove-ai.com drops to http because Let’s Encrypt can’t provision — the apex points at AWS, not Netlify’s 75.2.60.5.

I’ve already: verified nameservers, removed a duplicate www NETLIFY record, and the raw .netlify.app URL works fine. The apex has served these AWS IPs for several days regardless.

Please clear the stale apex records / rebuild my NS1 zone so kove-ai.com resolves to Netlify and the certificate can provision.

Let me know if I can provide any more information, thanks for your help!